Android apps are full of potential leaks, finds study

Oct 22, 2012 by Nancy Owano report
Credit: Sascha Fahl, et al.

(Phys.org)—Many Android apps are capable of falling victim to Man in the Middle (MITM) attacks. How many? Far too many. Thousands of apps in the Google Play mobile market present vulnerabilities because of the way that protocols are implemented—namely, the Secure Sockets Layer (SSL) and Transport Layer Security (TLS). That Android apps are open to malware by now is a yawn-evoking statement if there ever was one, but a new paper provides findings that are making this week's headlines. Computer science researchers from Philipps University of Marburg and Leibniz University of Hannover in Germany showed that Android apps that are used by over 180 million people can expose banking, social networking and email information.

They identified 41 apps available on the Google Play mart that leak sensitive information in traveling between smartphones and servers.
The researchers used a smartphone with 4.0 Ice Cream Sandwich in their investigations. They installed potentially vulnerable apps on the phone and set up a WiFi access point with a Man in the Middle (MITM) SSL proxy. They equipped the SSL proxy with a self-signed certificate or with one that was signed by a trusted CA, but for an unrelated host name. Of the 100 apps selected for manual audit, 41 apps proved to have exploitable vulnerabilities.

They captured credentials for numerous major services. "Furthermore, Facebook, email and cloud storage credentials and messages were leaked, access to IP cameras was gained and control channels for apps and remote servers could be subverted."

Their paper, testily called "Why Eve and Mallory Love Android: An Analysis of Android SSL (In)Security," discovered the apps that have SSL code that either accepts all certificates or all hostnames for a certificate and thus are potentially vulnerable to MITM attacks.

What also troubled the authors was the inability of many people in their survey to even recognize security threats attached to applications. "The results of our online survey with 754 participants showed that there is some confusion among Android users as to which security indicators are indicative of a secure connection, and about half of the participants could not judge the security state of a browser session correctly," they said.

Regarding secure connections, the researchers found that 47.5% of non-IT experts believed to be using a secure connection while the survey was served over HTTP. In addition, 34.7% of participants with prior IT education thought that they were using a secure channel when they were not. Only 58.9% of experts and 44.3% of non-experts correctly identified that they were using a secure or insecure connection when prompted.

In summing up, the authors pointed to a need for more education and easier tools that can enable the secure development of Android apps. They also called attention to the need for research to identify which countermeasures can ensure the right mix of usability, security benefits and economic incentives for large-scale deployment.

Android by the numbers merits that kind of care. Android is the most used smartphone operating system in the world. Building on the contributions of the open-source Linux community and more than 300 hardware, software, and carrier partners, Android has become the fastest-growing mobile operating system. The numbers keep shifting, but Android's market share currently stays over 50 percent. Android users download more than 1.5 billion apps and games from Play each month, and the number is growing.

Explore further: Thanksgiving travel woes? There's an app for that

More information: Research paper: www2.dcsec.uni-hannover.de/fil… android/p50-fahl.pdf

Via Arstechnica

Related Stories

Android users get malware with their apps

Mar 02, 2011

(PhysOrg.com) -- As new platforms make their way into the market there will always someone who is looking to exploit them for illegal or unethical ends. More proof of that fact has come today when Google was ...

Android mug shots have no lock and key

Mar 04, 2012

(PhysOrg.com) -- If Google loyalists will persist that this Internet Goliath can do no evil, they at least need to admit, based on new evidence this week, that Google can do a lot of mindless harm. A security ...

Recommended for you

Audi to develop Tesla Model S all-electric rival

15 hours ago

The Tesla Model S has a rival. Audi is to develop all-electric family car. This is to be a family car that will offer an all-electric range of 280 miles (450 kilometers), according to Auto Express, which ...

A green data center with an autonomous power supply

21 hours ago

A new data center in the United States is generating electricity for its servers entirely from renewable sources, converting biogas from a sewage treatment plant into electricity and water. Siemens implemented ...

After a data breach, it's consumers left holding the bag

21 hours ago

Shoppers have launched into the holiday buying season and retailers are looking forward to year-end sales that make up almost 20% of their annual receipts. But as you check out at a store or click "purchase" on your online shopping cart ...

Can we create an energy efficient Internet?

21 hours ago

With the number of Internet connected devices rapidly increasing, researchers from Melbourne are starting a new research program to reduce energy consumption of such devices.

Brain inspired data engineering

22 hours ago

What if next-generation ICT systems could be based on the brain's structure and its cognitive and adaptive processes? A groundbreaking paradigm of brain-inspired intelligent ICT architectures is being born.

User comments : 3

Adjust slider to filter visible comments by rank

Display comments: newest first

Temple
2.3 / 5 (3) Oct 22, 2012
But they're OPEN!
Grallen
3 / 5 (2) Oct 23, 2012
This basically amounts to "you have the ability to install software on your phone made by bad programmers".......
DarkHorse66
1 / 5 (1) Oct 23, 2012
As I have said before, in an earlier thread: "If it is programmable, it is hackable", especially if you can download or upload to it. Bad or thoughtless programming just makes that easier...and more tempting.
Cheers, DH66

Please sign in to add a comment. Registration is free, and takes less than a minute. Read more

Click here to reset your password.
Sign in to get notified via email when new comments are made.